

[https://github.com/Teycir/ApiHunter](https://github.com/Teycir/ApiHunter)

Open sourced my API pentester. MIT.

# Key Features

**False Positive Reduction:**

* SPA catch-all detection with canary probing
* Context-aware secret validation (frontend vs backend)
* Body content validation and referer checking
* Response fingerprinting to skip duplicates

**Production-Safe:**

* Adaptive concurrency (AIMD) - backs off on 429/503 errors
* Per-host rate limiting with configurable delays
* Dry-run mode for active checks
* Per-host HTTP client pools

**WAF Evasion:**

* Runtime User-Agent rotation (100+ real browser UAs)
* Randomized request delays with jitter
* Exponential backoff on retries
* No hardcoded scanner fingerprints

**CI/CD Integration:**

* Baseline diffing - only report NEW findings
* Streaming NDJSON output for real-time monitoring
* SARIF 2.1.0 for GitHub/GitLab Code Scanning
* Exit code bitmask for pipeline control (0x01 findings, 0x02 errors)

**Extensibility:**

* TOML-based CVE templates (no code changes needed)
* Nuclei YAML importer (`template-tool`  binary)
* Rust Scanner trait for complex logic



ApiHunter: Async API Security Scanner in Rust with 13 Modules (CORS/GraphQL/JWT/IDOR/CVE Templates) + CI/CD Integration